09 Jun
Posted by Abdul Aziz as Security, Windows Vista
One little known security feature of Windows Vista is File System and Registry Virtualization. File/registry virtualization gives an application its own “virtualized” view of a resource it is attempting to change using a copy-on-write strategy. For example, when the application attempts to write to a file in the program files directory, Windows Vista gives the application its own private copy of the file in the user’s profile so the application will function properly.
File and registry virtualization helps users who have restricted access to the registry and to the file system write to these protected areas. Virtualization creates a “per user” copy and then redirects successive data operations. For example, assume that an application is running under a Limited User Account or under accounts that require User Account Control permissions.
When this application writes to a system location, such as to the %programfiles% folder, Windows Vista redirects write operations and read operations to a user-specific location in the user’s profile folder (%localappdata%\VirtualStore).
By default, this location is C:\Users\ User_name \AppData\Local\VirtualStore\Program Files\ Application_name.
Registry virtualization works similarly but applies to registry keys under the HKEY_LOCAL_MACHINE\SOFTWARE subtree. The keys and data under this subtree are redirected to the HKEY_CURRENT_USER\Software\Classes\VirtualStore subkey.
To enable virtualization for an application load the program, open the task manager, choose to display the virtualization column, right click on the program’s exe file and select Virtualization.

One Response
Tip: Install and Run Software on Windows XP without affecting Registry/Disk using “RunAs” by Tech[dot]Blog
January 5th, 2008 at 12:29 pm
1[...] affecting the registry. While this is not strictly comparable to Windows Vista’s inbuilt Sandbox, Registry & File System Virtualization feature, it is a quick method to run programs such as IE on XP in restricted mode, preventing [...]
RSS feed for comments on this post · TrackBack URI
Leave a reply